Description
Email enumeration
Impact
An unauthenticated attacker with access to the back-office URL can manipulate the id_employee and reset_token parameters to enumerate valid back-office employee email addresses.
Impacted parties: Store administrators and employees: their email addresses are exposed. Merchants: risk of phishing, social engineering, and brute-force attacks targeting admin accounts.
Patches
PrestaShop 8.2.3
Workarounds
You must upgrade, or at least apply the changes from the PrestaShop 8.2.3 patch. More information: https://build.prestashop-project.org/news/2025/prestashop-8-2-3-security-release/
Original text by NVD (NIST), public domain.
CVSS metrics 3.1
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · secondaryCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:NAttack vectorNetwork
ComplexityHigh
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityLow
IntegrityNone
AvailabilityNone
References
Found a vulnerability?
Write to the PrestaShop core security team:
security-core@prestashop.com